Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2023, 13:46
Behavioral task
behavioral1
Sample
c0bea0a11853ecbdd169b0d0a.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
c0bea0a11853ecbdd169b0d0a.exe
Resource
win10v2004-20230703-en
General
-
Target
c0bea0a11853ecbdd169b0d0a.exe
-
Size
1.2MB
-
MD5
f20c74f02de55472d8b565868a19f4f5
-
SHA1
7be531a0a8ca1e686e6f7ff70fc3c2de963684fe
-
SHA256
c0bea0a11853ecbdd169b0d0ac30f0afcba308555752a0ead4de45895ec69ed2
-
SHA512
bd0664c6bb354ea240f942f8911daf494e62f97af6253ae77768b8d206e4c3245af655da94af410816917c1f7293123bc4dafa1ec8cc57fc1b5506fe5b3bebef
-
SSDEEP
24576:U2G/nvxW3Ww0t1Qo4QruJTrTn5mC8IasJ8lkf6LgH:UbA301n47rzrJfkY
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2592 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4360 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4084 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 944 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4248 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 784 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1352 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4340 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2072 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4228 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 804 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3052 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1688 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3324 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3964 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1328 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3388 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3848 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3096 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5028 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4184 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1248 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3732 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 444 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4892 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4996 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1736 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 848 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4824 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4560 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1572 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 536 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1556 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 640 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2216 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2740 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4764 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1640 4268 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4972 4268 schtasks.exe 83 -
resource yara_rule behavioral2/files/0x00080000000231d1-143.dat dcrat behavioral2/files/0x00080000000231d1-144.dat dcrat behavioral2/memory/2456-145-0x00000000009E0000-0x0000000000AD2000-memory.dmp dcrat behavioral2/files/0x00060000000231e5-148.dat dcrat behavioral2/files/0x0006000000023217-190.dat dcrat behavioral2/files/0x0006000000023217-189.dat dcrat -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation perfCrt.exe Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation c0bea0a11853ecbdd169b0d0a.exe Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 2 IoCs
pid Process 2456 perfCrt.exe 1852 services.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\ModifiableWindowsApps\OfficeClickToRun.exe perfCrt.exe File created C:\Program Files\7-Zip\Lang\cmd.exe perfCrt.exe File created C:\Program Files\7-Zip\Lang\ebf1f9fa8afd6d perfCrt.exe -
Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\__tmp_rar_sfx_access_check_240631515 c0bea0a11853ecbdd169b0d0a.exe File opened for modification C:\Windows\xpdAC628S.bat c0bea0a11853ecbdd169b0d0a.exe File opened for modification C:\Windows\perfCrt.exe c0bea0a11853ecbdd169b0d0a.exe File created C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe c0bea0a11853ecbdd169b0d0a.exe File created C:\Windows\Globalization\Sorting\dllhost.exe perfCrt.exe File created C:\Windows\schemas\Provisioning\088424020bedd6 perfCrt.exe File created C:\Windows\Globalization\Sorting\5940a34987c991 perfCrt.exe File created C:\Windows\rescache\_merged\3970336390\SearchApp.exe perfCrt.exe File created C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\explorer.exe perfCrt.exe File created C:\Windows\schemas\Provisioning\conhost.exe perfCrt.exe File created C:\Windows\Offline Web Pages\perfCrt.exe perfCrt.exe File created C:\Windows\xpdAC628S.bat c0bea0a11853ecbdd169b0d0a.exe File created C:\Windows\perfCrt.exe c0bea0a11853ecbdd169b0d0a.exe File opened for modification C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe c0bea0a11853ecbdd169b0d0a.exe File created C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\7a0fd90576e088 perfCrt.exe File created C:\Windows\Offline Web Pages\66992792adb75e perfCrt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3324 schtasks.exe 4892 schtasks.exe 1736 schtasks.exe 628 schtasks.exe 4824 schtasks.exe 4764 schtasks.exe 4972 schtasks.exe 444 schtasks.exe 4084 schtasks.exe 944 schtasks.exe 1352 schtasks.exe 1876 schtasks.exe 4228 schtasks.exe 3052 schtasks.exe 3964 schtasks.exe 640 schtasks.exe 1248 schtasks.exe 4248 schtasks.exe 784 schtasks.exe 4340 schtasks.exe 1468 schtasks.exe 2040 schtasks.exe 3388 schtasks.exe 4184 schtasks.exe 848 schtasks.exe 2216 schtasks.exe 4556 schtasks.exe 1640 schtasks.exe 4360 schtasks.exe 2072 schtasks.exe 2252 schtasks.exe 2592 schtasks.exe 2164 schtasks.exe 1328 schtasks.exe 2940 schtasks.exe 2740 schtasks.exe 3848 schtasks.exe 5028 schtasks.exe 3732 schtasks.exe 4996 schtasks.exe 4560 schtasks.exe 1572 schtasks.exe 536 schtasks.exe 2152 schtasks.exe 1856 schtasks.exe 804 schtasks.exe 3096 schtasks.exe 1664 schtasks.exe 1688 schtasks.exe 2124 schtasks.exe 1556 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings c0bea0a11853ecbdd169b0d0a.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 2456 perfCrt.exe 1852 services.exe 1852 services.exe 1852 services.exe 1852 services.exe 1852 services.exe 1852 services.exe 1852 services.exe 1852 services.exe 1852 services.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1852 services.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2456 perfCrt.exe Token: SeDebugPrivilege 1852 services.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2928 wrote to memory of 4304 2928 c0bea0a11853ecbdd169b0d0a.exe 79 PID 2928 wrote to memory of 4304 2928 c0bea0a11853ecbdd169b0d0a.exe 79 PID 2928 wrote to memory of 4304 2928 c0bea0a11853ecbdd169b0d0a.exe 79 PID 4304 wrote to memory of 228 4304 WScript.exe 80 PID 4304 wrote to memory of 228 4304 WScript.exe 80 PID 4304 wrote to memory of 228 4304 WScript.exe 80 PID 228 wrote to memory of 2456 228 cmd.exe 82 PID 228 wrote to memory of 2456 228 cmd.exe 82 PID 2456 wrote to memory of 1852 2456 perfCrt.exe 135 PID 2456 wrote to memory of 1852 2456 perfCrt.exe 135 PID 1852 wrote to memory of 2876 1852 services.exe 136 PID 1852 wrote to memory of 2876 1852 services.exe 136 PID 1852 wrote to memory of 4380 1852 services.exe 137 PID 1852 wrote to memory of 4380 1852 services.exe 137 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0bea0a11853ecbdd169b0d0a.exe"C:\Users\Admin\AppData\Local\Temp\c0bea0a11853ecbdd169b0d0a.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\xpdAC628S.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\perfCrt.exe"C:\Windows\perfCrt.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\odt\services.exe"C:\odt\services.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac94bb2e-5271-4578-95c5-41cc27c3b116.vbs"6⤵PID:2876
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fad100c-a5a1-4b8c-b124-7eacd4fc6a2e.vbs"6⤵PID:4380
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\Sorting\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\Sorting\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\odt\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\odt\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\schemas\Provisioning\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\schemas\Provisioning\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\schemas\Provisioning\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\odt\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\odt\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "perfCrtp" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\perfCrt.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "perfCrt" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\perfCrt.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "perfCrtp" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\perfCrt.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5d44a0d5049e4bb93de6b8ae80b1ea400
SHA120de60f1064befdb842472df134b8f1ab550d09f
SHA2562e26bde836cd4719eeae7e93053596a1514c3eccba18d79ac3c5627a3c226672
SHA512414525d4e4de823e58798d7956b80ce00c4b65ea8cc20436f0a95162eef8f8b33011f1a2e90379a9277b0e0cbfbc0931a8e0ddd918a4a47ab69408c44d969182
-
Filesize
695B
MD5847773294562d2aed9dbb80592d3c508
SHA14e04c26157089ee901fa26561b3bda15ca5d678b
SHA256458110326ed6eee2bf79c54cedf8212cb5cea995d0844812a1f8eb9abd45842f
SHA512d5460ec9216fbcf61c95352690ff23120ebbef5ba1fcba25aba64cd9c4c6c10c359020ead9377fb371e3ffdb8de65f83a76004ec9707bd941c9cf1d5584fe719
-
Filesize
204B
MD5bda4c38d73a75f19a5b0db1e6e0b7754
SHA119d73217e43de79c98a853e7b67705013578e348
SHA256bd0bffa96bb67d96b7015d60cbb3bfaf64a7d1d8191e49fa17f7352a44058d4a
SHA512743f332733bbf8cd9be78fd4a2e8879e1fb895c1c329b71edb2fc6756e021cfd746dcaa38d86cc5f007a1b0f08cf2c6fbc1b695a5f5520c8c67aca5e08d812e5
-
Filesize
935KB
MD5f553aaacd5d5d904ae5103a9f9d1d8e2
SHA129d46f0d7be8aaf8c9348d706395c5e5ad7095dd
SHA256c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e
SHA512d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b
-
Filesize
935KB
MD5f553aaacd5d5d904ae5103a9f9d1d8e2
SHA129d46f0d7be8aaf8c9348d706395c5e5ad7095dd
SHA256c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e
SHA512d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b
-
Filesize
935KB
MD5f553aaacd5d5d904ae5103a9f9d1d8e2
SHA129d46f0d7be8aaf8c9348d706395c5e5ad7095dd
SHA256c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e
SHA512d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b
-
Filesize
35B
MD57278c7ae6efbd4b50e3707c4dc4c608a
SHA1c8e1db9b85f599c98b278571b147cf81fe2fbae4
SHA2568f2fd99bb0dfa66ccca2c9173120318ea6702c64a5e112f63f9c2145ed9fe9dd
SHA512d06d550b8eec81c4faa8aca795dea9aac748cf4ea8e4ce42bf73403f6f2be67616e2732ecdcf2eca390448c75a026b011aa2b8536a6fdcb4a07c12f71486049b
-
Filesize
935KB
MD5f553aaacd5d5d904ae5103a9f9d1d8e2
SHA129d46f0d7be8aaf8c9348d706395c5e5ad7095dd
SHA256c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e
SHA512d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b
-
Filesize
935KB
MD5f553aaacd5d5d904ae5103a9f9d1d8e2
SHA129d46f0d7be8aaf8c9348d706395c5e5ad7095dd
SHA256c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e
SHA512d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b